Log in Start free

Vulnerability · Published May 30, 2024 · Assigned by Linux

CVE-2024-36910uio_hv_generic: Don't free decrypted memory

High 8.4

In plain English

A high-severity information exposure in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 83.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus device UIO driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.94-1DEBIAN-CVE-2024-36910
Debian:13linux6.8.11-1DEBIAN-CVE-2024-36910
Debian:14linux6.8.11-1DEBIAN-CVE-2024-36910
Ubuntu:24.04:LTSlinux6.8.0-40.40UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-aws6.8.0-1013.14UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1013.14~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-azure6.8.0-1012.14UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1012.14~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-gcp6.8.0-1012.13UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1012.13~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-gke6.8.0-1008.11UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-40.40~22.04.3UBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-ibm6.8.0-1010.10UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-40.40.1UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1011.11UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1011.11~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1011.11.1UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1010.10UBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-oracle6.8.0-1010.10UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-raspi6.8.0-1009.10UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-36910
Ubuntu:24.04:LTSlinux-riscv6.8.0-40.40.1UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-36910
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-36910

Affected products (as reported)

VendorProductVersions
Linux Linux d4dccf353db80e209f262e3973c834e6e48ba9a9 – before dabf12bf994318d939f70d47cfda30e47abb2c54d4dccf353db80e209f262e3973c834e6e48ba9a9 – before 6466a0f6d235c8a18c602cb587160d7e49876db9d4dccf353db80e209f262e3973c834e6e48ba9a9 – before fe2c58602354fbd60680dc42ac3a0b772cda7d23d4dccf353db80e209f262e3973c834e6e48ba9a9 – before 3d788b2fbe6a1a1a9e3db09742b90809d51638b7
Linux Linux 5.16

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References